Google Cloud virtual machines running on fifth-generation AMD EPYC processors, known as Turin, require guest operating system patches and a full stop-and-start cycle to mitigate three CPU side-channel vulnerabilities, with further coverage provided by The Hacker News.
The vulnerabilities, classified as Transient Scheduler Attacks, include two previously disclosed flaws and a new issue identified as CVE-2026-0004. These flaws may allow an attacker with code execution on the same processor core to infer sensitive data from other processes or the kernel. Affected machine series include C4D, N4D, H4D, Z4D and G4. While Google has already implemented mitigations to prevent cross-VM attacks, users must update their guest kernels once patches become available. A simple reboot is insufficient; administrators must stop and start their instances to ensure the updated CPU information is applied. AMD notes that Zen 5 processors are impacted differently than earlier generations, and full mitigation requires both platform firmware and operating system updates. Although the Cybersecurity and Infrastructure Security Agency has not added these flaws to its known exploited vulnerabilities catalog, users are encouraged to monitor vendor security bulletins. Performance impacts may occur following the application of these fixes, requiring administrators to evaluate the risks to their specific workloads.
Source: The Hacker News
